Security · 30 October 2026
Hugging Face Model Abuse Returns, Hijacking GPUs for Crypto Mining
A campaign abusing Hugging Face models with trust_remote_code downloaded over 28,000 times and total 32,000 downloads, installing crypto miners on self‑hosted inference servers; a fake Solana kit also tricks AI agents into installing a RAT.
Why it matters
Reevaluate model onboarding policies to block trust_remote_code by default; the campaign hijacked GPUs via malicious Hugging Face models.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 30 Oct →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.